Hi--I am running DB Audit 3.0.08 on a Windows 2003 Server with SQL Server 2000 SP4, and I'm coming up with the following error in the Application Event Log:

Event ID 1001

The description for Event ID ( 1001 ) in Source ( DB Audit ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event:

Error updating registry!.

So far, I've installed this with a SQL Server (DB LIB) connection using 'sa' to connect to the database instance. There were no installation errors logged to the System or Application Event log, and I installed this as an administrator on the box, so what might be the problem here?

Regards, Jonathan

Wed May 17, 2006 3:11 pm

SysOpSite Admin

Joined: 26 Nov 2006Posts: 6754

Re: Trouble enabling system auditing for SQL Serve

You don't use an empty password for 'sa' by any chance?

Does the SQL Server service account have permissions to save data in the registry?

: The description for Event ID ( 1001 ) in Source : ( DB Audit ) cannot be found. The local computer may : not have the necessary registry information or : message DLL files to display messages from a remote : computer. You may be able to use the /AUXSOURCE= : flag to retrieve this description; see Help : and Support for details. The following information : is part of the event: Error updating registry!.

: So far, I've installed this with a SQL Server : (DB LIB) connection using 'sa' to connect to the database : instance. There were no installation errors : logged to the System or Application Event log, : and I installed this as an administrator on the box, : so what might be the problem here?

: Regards, : Jonathan

Wed May 17, 2006 3:43 pm

Jonathan

Joined: 08 Oct 2003Posts: 13

Re: Trouble enabling system auditing for SQL Serve

: You don't use an empty password for 'sa' by any chance?

No, I don't.

: Does the SQL Server service account have permissions to save data in the : registry?

Yes. It is running as a full administrator on the local machine.

I have a few installation customizations on this box: the service account is running as a full admin, and the installation is pointing to D:\Program Files\Microsoft SQL Server\ instead of on the C: volume. That is for both the executable files and databases. Does that make a difference in this case?

Wed May 17, 2006 4:00 pm

SysOpSite Admin

Joined: 26 Nov 2006Posts: 6754

Re: Trouble enabling system auditing for SQL Serve

D:\ or C:\ doesn't make any difference. The error says it is unable to update the registry. Most likely it is a security issue.

IT is trying to create "SOFTWARE\Microsoft\MSSQLServer\DB Audit" key and save some configurations parameters there. It uses SQL Service current account for the registry operations. Can you verify that account has the necessary permissions?

: No, I don't.

: Yes. It is running as a full administrator on the : local machine.

: I have a few installation customizations on this box: the service account is : running as a full admin, and the installation : is pointing to D:\Program Files\Microsoft SQL Server\ : instead of on the C: volume. That is for both the : executable files and databases. Does that make a : difference in this case?

Wed May 17, 2006 6:23 pm

SysOpSite Admin

Joined: 26 Nov 2006Posts: 6754

Re: Trouble enabling system auditing for SQL Serve

By the way, how do you connect to the database in DB Audit?Which driver and options you select?

: D:\ or C:\ doesn't make any difference. The error says it is unable to update : the registry. Most likely it is a security issue.

: IT is trying to create "SOFTWARE\Microsoft\MSSQLServer\DB Audit" : key and save some configurations parameters there. It uses SQL Service : current account for the registry operations. Can you verify that account : has the necessary permissions?

Wed May 17, 2006 7:53 pm

Jonathan

Joined: 08 Oct 2003Posts: 13

Re: Trouble enabling system auditing for SQL Serve

: D:\ or C:\ doesn't make any difference. The error says it is unable to update : the registry. Most likely it is a security issue.

: IT is trying to create "SOFTWARE\Microsoft\MSSQLServer\DB Audit" : key and save some configurations parameters there. It uses SQL Service : current account for the registry operations. Can you verify that account : has the necessary permissions?

Yes, I verified that the account had the correct permissions as an administrator on the box, but dropping and readding the account to the Administrators group, then restarting the SQL services didn't do anything to change the results. On a thought, I changed the SQL services to run under the local System account and that seems to get me past the error writing to the registry.

However, now I get this error in the Application event log:

Error (dbcmd) executing sp_bindsession procedure.

I use the DB LIB SQL Server driver in order to connect. DB Audit is locally installed on the same box as the instance (it's a test VMWare image). That's in answer to your other question.

Thu May 18, 2006 10:33 am

SysOpSite Admin

Joined: 26 Nov 2006Posts: 6754

Re: Trouble enabling system auditing for SQL Serve

I think you can now switch back from the localsystem to the regular account as the registry needs to be set only once. The other error related to sp_bindsession sound familiar and has been posted several times here. In one case it was resolved by fixing public role membership, see http://www.softtreetech.com/cgi_bin/mconfig.cgi?read=1145 for details, in 2 other cases I suggested similar thing but didn't get any response back so I don't know if that helped or not.

Please let me know if the service account is set explicitly as a member of the public role and it is a user in the master database.

: Yes, I verified that the account had the correct : permissions as an administrator on the box, but dropping : and readding the account to the Administrators group, then : restarting the SQL services didn't do anything to change the : results. On a thought, I changed the SQL services to : run under the local System account and that seems to get me : past the error writing to the registry.

: However, now I get this error in the Application event log: Error (dbcmd) : executing sp_bindsession procedure.

: I use the DB LIB SQL Server driver in order to connect. DB Audit is : locally installed on the same box as the instance (it's a test VMWare : image). That's in answer to your other question.